Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2023, 14:21

General

  • Target

    Microsoft-Activation-Scripts-master/MAS/Separate-Files-Version/Activators/HWID_Activation.cmd

  • Size

    54KB

  • MD5

    7ddb1766a6574fd10e29303e24272ad1

  • SHA1

    c91185a98353e64ebd4707e26fbbffa5d4d7e7c3

  • SHA256

    005f28b334a8f0bc0b611a616e6558127d21dfec43a163ed4536c2bb46477ef9

  • SHA512

    756b28a6787dc2de0d0372901982d4c384a02cf5517aa944ed2cbb2cebd23c172200f9220faf725b089ea97c8f81c878cd7e602a73b8721c1f89114ebe03549f

  • SSDEEP

    768:h2zZiOKJ5yorr997+3YWSWMxahF438mpr8Fp9lvCRdi5NEjS+C7S4jFh0z1E6yfH:oi3yg2MxMMUflsdi54Em0Iy6yP4Nm36s

Score
4/10

Malware Config

Signatures

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts-master\MAS\Separate-Files-Version\Activators\HWID_Activation.cmd"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\System32\sc.exe
      sc query Null
      2⤵
      • Launches sc.exe
      PID:1716
    • C:\Windows\System32\find.exe
      find /i "RUNNING"
      2⤵
        PID:2064
      • C:\Windows\System32\findstr.exe
        findstr /v "$" "HWID_Activation.cmd"
        2⤵
          PID:2124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ver
          2⤵
            PID:2348
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe write-host -back '"Red"' -fore '"white"' '"==== ERROR ===="'
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe write-host -back '"Black"' -fore '"Yellow"' '"Press any key to Exit..."'
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2764

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          d340f3b2c08a61a38be92d906a1f4fd3

          SHA1

          0709279754099f93cde78ee68628e9faad294c03

          SHA256

          316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e

          SHA512

          059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WHYXCIW05P0TDA9R9AT1.temp

          Filesize

          7KB

          MD5

          d340f3b2c08a61a38be92d906a1f4fd3

          SHA1

          0709279754099f93cde78ee68628e9faad294c03

          SHA256

          316ef677c433f4db5920e8166526189513755e17aeac29006033ba48e1576a1e

          SHA512

          059ba31496feb31f8271d5e2e7032ea283c36470c386857a2d98130e6ac835108b8aab05928fc1b7f8982d9605f81a080d602f5705a325c4466eeabbeac68628

        • memory/2260-8-0x0000000002A10000-0x0000000002A90000-memory.dmp

          Filesize

          512KB

        • memory/2260-5-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

          Filesize

          9.6MB

        • memory/2260-4-0x000000001B340000-0x000000001B622000-memory.dmp

          Filesize

          2.9MB

        • memory/2260-9-0x0000000002A10000-0x0000000002A90000-memory.dmp

          Filesize

          512KB

        • memory/2260-10-0x0000000002A10000-0x0000000002A90000-memory.dmp

          Filesize

          512KB

        • memory/2260-11-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

          Filesize

          9.6MB

        • memory/2260-6-0x0000000001F40000-0x0000000001F48000-memory.dmp

          Filesize

          32KB

        • memory/2260-7-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

          Filesize

          9.6MB

        • memory/2764-17-0x000000001B250000-0x000000001B532000-memory.dmp

          Filesize

          2.9MB

        • memory/2764-19-0x0000000002040000-0x0000000002048000-memory.dmp

          Filesize

          32KB

        • memory/2764-20-0x0000000002B00000-0x0000000002B80000-memory.dmp

          Filesize

          512KB

        • memory/2764-18-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/2764-21-0x0000000002B00000-0x0000000002B80000-memory.dmp

          Filesize

          512KB

        • memory/2764-22-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB

        • memory/2764-23-0x0000000002B0B000-0x0000000002B72000-memory.dmp

          Filesize

          412KB

        • memory/2764-24-0x000007FEF50D0000-0x000007FEF5A6D000-memory.dmp

          Filesize

          9.6MB